ACH fraud: unauthorized debits and return windows

ACH fraud can appear as unauthorized debits or redirected credits. Return and dispute windows are often short, so same-day documentation matters.

Notify your bank in writing with entry trace numbers, company IDs, amounts and settlement dates. Request that related records be preserved beyond ordinary retention defaults.

Review who had access to banking credentials and whether vendor or payroll files were altered. Internal compromise and external social engineering can look similar on the statement line.

If funds were sent outbound via ACH to a fraudulent beneficiary, treat the matter like other push-payment fraud. Beneficiary details, approvals and deception evidence all belong in the file.